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Executive summary 


This is the follow-up to an ICO programme of work which explored the Timeliness of responses to information access 
requests by police forces in England, Wales and Northern Ireland. 

That work culminated in a report which we published in November 2020. The report presented the results of our monitoring 
and engagement with 11 underperforming police forces. We shared good practice that was taking place across the police 


sector, and made a series of recommendations to forces. These were designed to improve compliance with the statutory 
timeliness provisions in information rights legislation. 


Our follow-up explores the impact of that report across the police sector and whether forces that underwent the monitoring 
and engagement process continued to improve. We did this through a survey of all police forces in England, Wales and 
Northern Ireland, as well as workshops with the forces that went through the monitoring and engagement process. 


Aims 
This follow-up aims to: 
e explore whether police forces took up the recommendations from our November 2020 timeliness report, and whether 


they had positive results; 


e present our analysis of the data on police compliance with information request timeliness for the period since our 
report was published; 


e evaluate the effectiveness of our programme of monitoring and engagement; and 


e share the experience of changes that police forces have made in order to drive compliance. 
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Key findings 
yO 
( 1 ) The report was positively received by the police and its recommendations were taken up by the majority of 
se j forces. 


i A Since the report was published, the police sector has improved compliance with the timeliness provisions of 
| 2 } data protection legislation and the Freedom of Information Act 2000 (FOIA). However more needs to be 
eee done, and questions remain about resilience when unexpected peaks in demand arise. 


je The forces that underwent ICO monitoring and engagement have improved their compliance rates. Their rate 
| 35 of improvement was stronger than that of the sector as a whole and stronger than that of forces with 


pa equivalent workloads that did not go through the monitoring and engagement process. 
pS hae? 
( 4 Swift action to change the way forces worked meant that overall the COVID-19 pandemic had a broadly 
Soe, neutral impact on the police’s information request capability. 
S 
VN 


( 5 The ability to achieve compliance remains strongly linked to resourcing and accountability. 
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Background 


In November 2020 the ICO published the results of a programme of work about police forces and their compliance with the 
timeliness provisions of information access legislation. 


The work followed concerns about their ability to consistently comply with the law about timeliness as detailed in the UK 
GDPR, the Data Protection Act 2018 and the Freedom of Information Act 2000. These legislations each carry clear time limits 
for responding to information requests, however the data we had suggested they were being breached by the police in too 
many instances. 


Forces described to us a ‘perfect storm’ of changes that had resulted in an increase in the volume and complexity of 
information governance work against a background of reduced budgets, including: 


e a substantial increase in request numbers; 


e competing priorities on information governance functions, such as court orders; and 


e new complexities, such as the appropriate disclosure of footage collected from body-worn cameras. 


As the regulator overseeing the legislation we initiated a project to improve information request timeliness within the police 
sector. It involved monitoring a group of 11 underperforming police forces by analysing their performance statistics and then 
working with them to initiate an action plan for improvement. It also involved working with the National Police Chief’s Council 
(NPCC) to analyse compliance rates from NPCC data across the police sector from between September 2018 and August 
2020. 


Our work culminated in a report detailing our findings and some recommendations which all police forces could use to 
improve compliance in this area as well as a commitment to follow up in a year’s time. 


This is the follow-up to our original report. It contains our analysis about the effectiveness of the monitoring and 
engagement process and recommendations we made in November 2020. It also contains further examples of good practice 
from the forces that have been working to improve their timeliness compliance. 
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This follow-up is based on: 


e our analysis of data about subject access requests (SAR) and FOIA requests over the previous year from every police 
force in England, Wales and Northern Ireland?; 


e a survey of every police force in England, Wales and Northern Ireland about the effectiveness of the compliance 
project, case studies of good practice, and the impact of the pandemic; and 


e workshops featuring representatives of the forces that participated in the monitoring and engagement process. 


Our data analysis 


With the help of the NPCC we have collated SAR and FOIA request handling data from each police force in England, Wales 
and Northern Ireland. We have analysed the data spanning the two-year period since autumn 2019. 


In particular, we looked at: 


e data about the numbers of requests that the police had received and closed to see if trends emerged across the sector 
as a whole; 


e the percentage of requests each month which police responded to within the statutory time limit; 


e the monthly totals of requests which each force has within its ‘pipeline’ awaiting response. Some of these requests 
were fresh, and in the process of being responded to. But a portion of the pipeline were a backlog of late requests; 
and 


e the percentage of requests in the pipeline that were overdue. 


: The Scottish Information Commissioner regulates the Freedom of Information (Scotland) Act 2002 and the Environmental Information (Scotland) Regulations, and so, as 
was the case with the November 2020 report, Police Scotland was not part of this work. 
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Has police performance improved? 


In the two-year period since autumn 2019 the timeliness rate across the police sector has experienced a modest overall 
improvement from 69% to 75%. It had improved to a peak of 81% in February 2021 but the figure has since fallen. 


The number of requests in the overall pipeline across the police sector has also been successfully addressed. It has come 
down from 12,094 to 10,191, which is a 16% reduction. However, the improvement in bringing this figure down had similarly 
peaked in February 2021, at which point the figure had reduced by 28% to 8,685. 


The percentage of the request pipeline that was overdue had also been reduced. This was from 61% to 33% by March 2021, 
only for the figure to trend upwards on a monthly basis thereafter, rising to 56% by August. 


The patterns from the data clearly show peaks in requests received in January 2020 and January 2021. We understand that 
these are typical, and follow relative troughs in the pattern of the data in December, a month when forces generally receive 
fewer requests. 


The data shows that forces recovered from a spike of incoming requests in January 2020 to achieve a sustained period where 
the number of information requests they were completing was broadly in line with the number of requests they had received. 


Progress was then interrupted after the police received a substantial spike in requests in March 2021. This spike is evident in 
the data for the whole sector which is reproduced below. But it was also clear from the individual data of 43 of the 46 forces 
that provided data for analysis. Our analysis of the data found that the number of requests which those 43 forces received in 
March 2021 was at least 25% higher than the average monthly volume during the period 2019-2021. 


We ran workshops with a number of police forces to explore their perspective on this programme of work. What we know 
from these conversations is that this spike in March 2021 followed the murder of Sarah Everard by an off-duty police officer. 
The police came under scrutiny about their vetting processes and their handling of vigils and protests held in the aftermath 
of her death. The data shows total police force FOIA requests in March 2021 were 50% higher than the average volume 
received and SARs were 30% higher. 
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Total police performance for key metrics 
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When looking at the FOI statistics exclusively, 
we can see that by August 2021 the pipeline 
total had been reduced to 67% of its September 
2019 total: coming down from 8,351 in 
September 2019 to 5,661 in August 2021. The 
timeliness rate had gone up from 71% to 83% in 
July 2020, before a fall in Spring 2021. 


After an initial reduction, the SAR pipeline 
eventually increased by 21% despite the number 
of requests received only increasing by 4%. 
However, the timeliness rate change was more 
encouraging, with an overall improvement from 
65% to 75% over the two-year period. 
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All forces' FOI performance 
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Take-up of report recommendations 


Having analysed the data for timeliness and request backlog management for Were police forces aware of the 
the last two years, we conducted a survey of all forces in England, Wales and original report on timeliness? 
Northern Ireland. 31 forces responded to our survey, representing a 


response rate of 67%. a Yes, and I have 4 


We asked forces about issues such as their methods of improving timeliness raadit 
compliance and how the COVID-19 pandemic affected their ability to = Yes, but I have 
maintain progress. We also asked forces about our report and their take-up not read it 

of the recommendations. 


» No, I was not 


The vast majority of responding forces told our survey that they were aware aware 


of the report and had read it. More than a third of forces told us that the ICO 
taking a specific interest in UK police force timeliness data had an impact on 
timeliness performance in their force. 


In the report we made nine recommendations to help forces improve timeliness in responding to information requests. We 
asked each force whether they had implemented any of the recommendations. 


The results of our survey were very positive: 25 forces (81%) had read the report and had either gone on to implement or 
were planning to implement at least one of its recommendations. 21 forces (68%) had already implemented at least six of 
the recommendations before the report was published. At least 10 forces have implemented, or are planning to implement, 
four of the nine recommendations. 
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2. FOI toolkit 13 EES 

3. Regular reporting 1) 

4. Publishing information access request statistics 12 1) 
5. Proactively publish information 14 La 

6. DPIAs 19 

7. Allocate sufficient resources 18 D] 

8. Share good practice 25 

9. Consult specialist sector bodies 27 
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Have forces implemented recommendations? 


0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 
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| 


1. Action plans 


| 


E Our force implemented this recommendation following the report 
» Our force is planning to implement this recommendation 

Our force was already performing the action within this recommendation 
m Our force has not implemented this recommendation 


We asked each force to tell us about impacts that implementing each recommendation had. The following is a summary of 


the recommendations we 
implementing them. 


Recommendation 1: 


To produce and publish 
action plans addressing 
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made in November 2020 with a selection of the feedback which police forces gave us about 


“Having an action plan in place has identified our weakness and strengths in respect of 


requests and what we will be putting in place to reduce the outstanding requests.” 


our FOI performance. We have set a clear target of how we want to address our backlog 


11 


delays in dealing with 
requests. 


Recommendation 2 


To use the FOI self- 

——ESE 
assessment toolkit to assess 
FOI performance and 
identify areas for 
improvement. 
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“This has enabled the Force to keep updated of where we are with timeliness of FOIs.” 


“We now have both chief officer oversight and support for this area of business.” 


“The toolkit allowed the Force to assess its compliance on FOIs and see where 
improvements needed to be made to improve the process/compliance.” 


“The toolkit assisted with backlog reduction.” 


“Our force has used the ICO self-assessment toolkit to populate the action plan in 
respect of timeliness of responses.” 


“We regularly assess performance against the ICO toolkit. This allows us as an 
organisation to assess our performance and we match this against the KPI data we 
collate locally and that which is provided from NPCC.” 


“Helped to focus our staff on areas of best practice and has resulted in improved 
compliance rates which is always our goal.” 


“It was a useful assessment tool for reviewing our current processes. It confirmed we 
were already working in accordance with the recommended standards and good 
practice.” 


“The toolkit had minimal impact. We have been servicing and responding to FOI 
requests in a timely and professional manner since the FOIA became law.” 
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Recommendation 3: 


To ensure that information 
rights departments regularly 
report to senior leaders 
within the force. 
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“Our Force already has an established governance system in place where performance 
measures with regards to information request response compliance feed into a larger 
corporate performance board. These statistics also feed into an Information 
Management Board chaired by the Force SIRO (DCC). Any difficulties identified in 
maintaining performance are highlighted in the Force risk register.” 


“Senior Leaders are given monthly updates on performance; allowing assessments to 
be made on any risks that might need to be addressed.” 


“The department has been reporting FOI performance on a weekly basis to senior 
management for a number of years. More recently data protection performance has 
been included as part of the weekly report.” 


“We report to our senior leadership team on a regular basis including monthly meetings 
so they are aware of the current situation and can help should any issues arise.” 


“Our Force is planning on publishing this information via our own website however we 
are awaiting the implementation of Single Online Home which is a national platform for 
Police Force websites.” 


“We are currently working alongside our corporate communication team and our case 
management system supplier to introduce this.” 


“A review of Force record-keeping has revealed performance statistics are unreliable. 
This is now subject to review in consultation with ICO to clarify methodology. 
Publication will commence once this is rectified.” 
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Recommendation 5: 


To proactively publish 
information which is 
frequently requested or of 
consistent interest to the 
community. 


Recommendation 6: 


To give due consideration to 
data subject rights’ when 
completing Data Protection 
Impact Assessments 
(DPIAs). 
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“The publication of FOI data has had some impact on demand reduction as new 
requesters can be signposted to existing data.” 


“We have proactively published requests over previous years. We are looking to start 
proactively publishing requests again onto our website.” 


“This has had no impact - we continue to receive the same high volume of requests. 
Anecdotal evidence would suggest that it stimulates more requests from requesters who 
are inspired by some of the published disclosures.” 


“This is in progress to some extent, but is awaiting further follow up following 
onboarding to a new website.” 


“We were already completing this action. The proactive publication of data does not 
appear to impact on the amount of requests we receive, even topics where the dataset 
is clearly available online still generate a huge amount of requests which receive a 
Section 21 response. It appears the applicants, in particular journalists, do not take any 
time to review the publication scheme and datasets on there as it is quicker for them to 
submit a new request and have the force send them a link.” 


“We are currently working on this and have also employed new members of staff to 
help achieve this which will assist us in remaining compliant with DPIAs.” 
“A question was added to our DPIA template. To date no impact has been noted.” 


“The Force already has a DPIA process in place as described in this recommendation. 
No impact has been felt as a result of this recommendation.” 
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Recommendation 7: 


To allocate sufficient 
resources to teams leading 
on information request 
compliance. 
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“Data Protection Impact Assessments (DPIAs) are routinely completed for any new 
systems or technology that process personal data. Developers and project managers 
are constantly reminded of the need to ensure accessibility to the personal data once 
loaded in order to support requests for information and/or other rights under the 
legislation.” 


“We recently recruited more staff into the department which is now starting to be 
reflected with our compliance improving.” 


“As a result of the Action Plan and as a result of a business case being put forward, the 
Information Request team were able to secure funding for additional posts in the 
Information Request Team to facilitate faster and better responses to information 
requests.” 


“We have conducted a demand analysis and projection and submitted a bid for 
additional funding to ensure that we are equipped to meet predicted increased future 
demand.” 


“There has also been the realignment of staff over the past 6 months which has seen 
the number of overdue requests reduce from 58 to 21.” 


“The report has been circulated but the resources have remained the same, mainly 
because our force has remained compliant in both SAR & FOI. However, as requests 
become more complex and the numbers increase, the resources will become stretched.” 
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Recommendation 8: 


To identify and share good 


practice across the police 
sector including via the 
NPCC. 


Recommendation 9: 
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“We have a really proactive regional group and frequently share good practice/ideas 
(especially for DP).” 


“We also engage in regional cross sector forums which include sharing of best practice 
across local government, health, ambulance and fire etc.” 


“Following the Constabulary recovering from the FOI backlog it experienced in 2019/20, 
our experience has been shared to assist another force recover from a similar position 
and we will continue to engage with the NPCC to share best practice.” 


“Procedures were updated and refined since ICO review, our working practices have 
been shared with NPCC and with other forces and at regional meetings.” 


“Our managers attend the regional FOI and DP meetings where information access 
rights are discussed in order to share good practice. Additionally, an update from the 
National Subject Rights Group (NSAG) and National FOI Steering Group is given by our 
regional representative.” 


“Force engagement with regional working group has been poor; however we are now 
attending, have established good working relations with neighbouring Forces and have 
begun dialogue about good practice.” 


“Guidance is always sought from NPCC with regards to information requests where 
required. This is invaluable.” 
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To engage with the NPCC 
and other bodies that 
provide practitioner training 
and technical assistance. 
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“Staff engage with the NPCC, National Police Freedom of Information and Data 
Protection Unit (NPFDU). They have engaged with the FOI Central referral Unit (as was) 
since its inception back in 2005! The assistance, advice, training etc they provide is 
invaluable. I am not aware of the National Subject Rights Group but will make enquiries 
in order that staff can engage with them as necessary.” 


“This has provided a useful resource in dealing with complex requests and to allow us to 
identify any training requirements which staff require. We actively engage with NPCC 
and NPFDU and ensure that any refresher training is arranged for staff.” 


“We haven't procured any direct resources as a Force but use national and regional 
specialists where required. Also, the ICO inspection has given us some good pointers for 
making improvements. As with other Forces, we have limited budgets and have to 
make use of the resources available to us (including the ICO).” 


“Our managers regularly engage with the National Data Protection Advisor and/or 
National FOI Advisor as well as our regional NSAG representative.” 
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Impact of the COVID-19 pandemic on police request handling 


Our analysis of the data shows that forces’ ability to respond to Reported pandemic impact on SAR and 
requests on time can be quickly undermined by an unexpected FOI request timeliness performance 
change in circumstance. This is the case unless they have a robust 

system for dealing with spikes in demand, staffing shortages or 

other events. 

The time period which our data analysis focused on includes the = Negatively 
period in which the coronavirus pandemic arrived in the UK. In = None 
doing so it placed unique and unprecedented pressures on our a Positively 


police forces. 


The data we analysed shows a reduction in requests that were 
received by the police during the period of the first national 
lockdown in Spring 2020. But it also shows that the timeliness rate 
went down across the sector as forces struggled to respond to information requests on time. 


We asked forces about the effect of the pandemic on handling information requests. Few said that the pandemic helped their 
FOIA and SAR performance, but most reported no overall impact. 


Some of the overall themes that came out of both our survey and our workshops with forces expanded on this: 
e many forces saw a reduction in information requests at the onset of the pandemic in the UK. The data shows us that 


for three months, both FOIA request and SAR numbers decreased across the sector as a whole; 


e the reductions in requests were temporary and were offset in many cases by staff absence through illness or self- 
isolation; and 


e staff that handle information requests had to change the way they worked, for example with some staff working from 
home. This caused initial difficulties with requests such as those where responses were in a physical media, or where 
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information requiring disclosure was held somewhere difficult to access, such as an office with limits on personnel 
permitted. 


There was a mixed response to whether forces had changed any processes as a result of the pandemic. But those that had, 
referenced increased homeworking with encrypted laptops and force telephones provided to staff. 


Other forces told us that more disclosures were made by secure email and fewer through the post, with the ability to disclose 
information such as body-worn video images being made available by a central electronic means. 


Pandemic advice from the ICO 


Like the police, many organisations have increased the amount of staff working from home in response to the pandemic. It 
may therefore be useful to highlight the resources which, as regulator, we have developed to help support organisations so 
that they remain compliant with data protection law. It includes the following: 


e Our security checklist which is designed to help organisations assess their IT solutions to make sure they are safe. The 
checklist does not represent a complete security solution, but will help identify some of the common IT vulnerabilities 
that we often see exploited. 


e Our list of things to consider about the devices that staff use to work from home. 


e Ten top tips for people working from home. 


e More information about complying with data protection law during the pandemic period can be found on the data 
protection and coronavirus information hub on our website. 
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Police feedback about the ICO November 2020 report 


In our survey, we asked forces to tell us whether there was anything about our report that we could have improved: 


“The report only takes into consideration FOI and SAR. I do 
understand that the report is focusing specifically on the 
rights of the subject, however most, if not all Police Force 
information request teams, deal with requests other than 
those received via FOI/SAR. Request teams will usually also 
deal with requests for legal proceedings, court orders etc. It 
would be helpful to those teams if their other competing 
commitments be considered.” 


“Reports like this are really useful.” 


“I think the key issue will be to acknowledge that 
recommendations will need to evolve over time and therefore 
this is part of an ongoing process. I would also suggest it 
would be useful if forces are required to provide individual 
responses to new recommendations either directly to the ICO, 
or via the NPCC FDU. This would, I believe, help to keep a 
spotlight on information management within individual 
forces.” 


“Include details of the consultation with requesters (members 
of the public and the media in particular), to demonstrate that 
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the publishing of more information on a public authority's 
website would then reduce the volume of requests.” 


“T felt that the report was constructive. Understanding the 
force structure and whether the DPO/ Head of IG (or the role 
with overall responsibility for SARS/FOIAs) has autonomy/ 
suitable seniority to direct resources might also be a factor 
which affects performance. 'DPO' having the ability to direct 
‘their resources’ effectively, without interference from a dept 
head to whom they may report who, for example, might direct 
SAR/ FOIA’ resources to deal with other competing demands 
which might fall within their portfolio.” 


“I am not sure on the benefit of the report, and believe it only 
assists those in difficulty or new to SAR/FOI processes.” 


“The report should include some real life examples describing 


how those forces have increased their compliance rates and 
what works well / not so well.” 
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“Engage with a wider demographic of forces within the report, 
provide more overall context for policing and current 
pressures and conduct similar exercises across the public 
sector in order to compare and contrast e.g. Civil service, local 
authorities, health and fire. Differentiated approach based on 
individual force performance e.g. light and heavy touch.” 


“I think it is effective as it is.” 


“Overall the report was well received so not a lot you could 
improve on. If being picky: - the report could have been 
shorter. Fine for practitioners, but a report of this size is 
always a difficult sell to Executive's when no ‘executive 
summary’. Appreciate there was a foreword but not quite the 
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same. Most people went straight to the rankings section which 
is fine if the data across 43 police forces can be trusted hence 
the reason I put a health warning round the data when 
presenting the paper because some of us are not convinced 
that every force is completing the fields correctly. I have 
previously fed this back to the ICO.” 


“The report does not represent any backlog work which effects 
the compliance rate and also does not incorporate any other 
areas of work the department who deal with FOI and SAR do 
which can also be a contributing factor, and also does not 
consider the structural format of the departments within each 
force.” 


We are grateful for the feedback provided from the police which will helps us consider what we might do differently with 


similar projects in the future. 
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Police feedback about performance league table concept 


As regulator, we discussed with police forces how we could help Would a league table be 
them improve the rate at which they responded to information helpful for forces? 
requests. 


One suggestion we wished to explore further was centrally curated 
monthly league tables - by the ICO or NPCC - of all police forces, 
ranking them by the key metrics in handling SAR and FOIA 
requests. 


We used our survey and workshops to find out more about the 
potential effectiveness of the idea. 


More than two thirds of the respondents to our survey said a league 
table would not be helpful. 


This consensus was reflected in the conversations which we had in workshops we held with representatives of forces from 
across the country who said that senior officers received lots of league tables, such as those comparing their force against 
others in relation to crime statistics. In that context, it was not clear that a league table about information request 
performance would achieve its desired impact. 


They also suggested that a performance league table might have detrimental effects within a force: impacting morale among 
the staff that handle the requests but who had little power to improve performance on their own. 


In order to improve transparency we recommended that police forces and the public are made aware of how forces are 
performing comparatively. We will liaise with representatives of polices forces to weigh up the benefits and risks of league 
tables to identify the best solution for all parties. 
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Our survey respondents also gave us their views about the league table idea: 


Against performance league tables In favour of performance league tables 


“Comparisons with other forces is not helpful without 
context that explains why that force may not have 
achieved the required compliance rates.” 


“We were under the assumption that this information 
was published on the NPCC website?” 


“We would still face the same challenges so no impact.” 


“We meet our response target rates already and in any 
event deal with relatively small numbers of FOI 
requests, currently.” 


“I would be prepared to tick 'yes' if I had the confidence 
that all forces were completing the statistical returns 
correctly. I would also suggest that the ICO looks at how 
the compliance figure is calculated to ensure this is fit 
for purpose moving forward.” 
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“It would create public debate and possibly allow for 
additional resources to be directed to disclosure units if 
required.” 


“I think this is likely to improve performance as, 
notwithstanding many competing priorities which have 
to be managed, no force would wish to be at the 
bottom/near the bottom of such a table.” 


“This would potentially make senior management take 
more note.” 


“It may help as it could result in extra resources or 
changes being made.” 


“I think this could help as we would be keen to ensure 
the reputation of the force is maintained. Although staff 
are always trying to follow legislation, it is inevitable that 
there are at times going to be delays caused by several 
factors such as resources and systems. This could mean 
that more funding could become available to assist.” 
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“Forces already perform to an optimum level and staff “I am not convinced that this would have a massive 
work to capacity in very difficult circumstances. impact in most cases, but a force at the 'bottom' of a 
Statistics are already available via most Force websites league table would presumably be subject to media 
and via FOI requests so I cannot see how a "league" scrutiny and likely to suffer reputational damage and in 
table would assist other than demoralising staff in those those circumstances it would arguably focus the mind. 
forces who are encountering issues beyond their control, However, I think most forces have appropriate internal 
which are in turn affecting compliance levels.” mechanisms to highlight such issues, and external 
pressure from NPCC leads/ICO would have a similar 
effect.” 


We would therefore refer forces to the fourth recommendation in our timeliness report. Publishing information request 
compliance statistics in line with the relevant code of practice will provide transparency about performance. Doing so will 
allow anyone interested in comparing force performance to do so if they wish, without the need for the NPCC or others to 
administer a formal league table. 


Follow-up of the monitoring and engagement process 


As part of the timeliness project we worked closely with 11 specific forces that had consistently failed to achieve compliance 
with information request timeliness requirements. 


This work involved monitoring these underperforming police forces by analysing their performance statistics and then 
working with them to put together, and measure progress against, an action plan for improvement. 


We reported on the effect of this in our 2020 timeliness report. In preparing this follow-up, we analysed whether the 
improvement continued. 


Our analysis of the information request data from these forces shows similar trends to that of the data of all forces, as shown 
above for the two-year period. However, while all forces achieved a timeliness rate improvement of 69% to 75%, the 11 that 
went through the monitoring and engagement process lifted their rate from a deeper baseline of 58% up to 72%. 
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They also significantly reduced their backlogs: from 5,854 requests in their September 2019 pipelines to 1,800 by July 2020 
(a 69% reduction). This was before the March 2021 spike which saw growth in both the overall pipeline and the volume of 
overdue requests. 


However, the data demonstrates that the performance of the 11 forces that went through the monitoring and engagement 
process improved at a greater rate than that of the police force sector as a whole. 
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We have also used the data to compare the performance of the 11 forces that went through the process against the 
performance of 11 similar forces which had no such intervention. 


To achieve a control group that could provide a meaningful comparison, we chose the 11 forces which had the closest 
volume of received requests to each of the 11 that went through the monitoring and engagement process. 
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Our comparison showed that the 11 forces which went through the process started in a worse position than the comparator 
11 in September 2019: they had substantially poorer timeliness rates (58% compared to 77%) and a greater ratio of 


overdue requests in their pipelines (76% compared to 52%). 


The data confirms that when comparing the key metrics to that of the control group, the 11 monitored forces made more 
progress than the 11 unmonitored forces. The timeliness rate of the monitored forces improved by 14% whereas the control 
group’s rate decreased by 6%. The overdue percentage of the pipelines of the monitored forces was similarly relatively 
successful, in that it had reduced by 7% compared to the control group’s increase of 13%. 
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Feedback from the 11 forces that underwent the monitoring and engagement process 


We facilitated two workshops in September 2021 so the forces that had gone through the How difficult was it 
monitoring and engagement process could share their experiences with us and with each for forces to gather 
other. Ten of the 11 forces that went through the process were represented and their data? 
feedback is as follows: 


100% 
Monitoring 90% 
Forces were positive about the monitoring process itself which “gave us time to improve”. 80% 
They had mixed views on the case management systems they used to extract the data. One 70% 
force said that the ICO monitoring precipitated regular reporting to senior management and 60% 


had identified a recruitment need. 50% 
40% 
30% 
20% 


10% 
In our survey we asked all forces, who had sent monthly data to the ICO by the NPCC, how 0% 
easy this data was to collect. Two thirds said that it was easy or very easy to collect the data. 


Four forces said that the monitoring was too focused on the timeliness rate, with less interest 
in the quality of responses that had been issued or on the reduced size of information request 
pipelines. 


mVery easy E Easy 
However some forces also told us that the systems they used to recall statistics require Not easy m Difficult 
sometimes substantial manual intervention in order to collate statistics. Five forces reported 
that they are currently having to undertake manual collation or manipulation of data whilst four forces told us they are 
considering, or in the process of, updating systems which would make statistical reporting easier. 


Action plans 


Forces were broadly positive about the action plans they worked on with the ICO to set out milestones for improving 
performance. Some forces said it was useful to have a focused, formal process and two forces in our workshops said they 
thought the template provided by the ICO was effective. 
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Others described how the plans helped to illustrate the amount of work that was required. Other feedback said the plans 
were quite broad and more helpful for the long rather than short term. One force suggested that the plan was too 
prescriptive: “It became more the ICO’s plan than our own. Might have benefitted from being tight on the ‘what’ and loose 
on the ‘how’.” 


We also received feedback through our survey including: 


e “The action plan has allowed the force to review areas where improvements were required such as resilience within 
the team. It identified the training requirements within the department. An action plan has only been implemented for 
FOI's.” 


e “As a result of the report and with particular regard to FOI where our compliance has been lower than we would like, 
we have used the ICO toolkit to conduct self-assessment and formulate our action plan. We are planning to again use 
this action plan to raise a business case for additional funding to be made available to secure further posts in the 
information request team.” 


e “The FOI Team produced an action plan in 2019 which resulted in compliance response rates across both forces going 
above the target of 90 per cent. Unfortunately, COVID-19 and other operational pressures / priorities has had an 
effect on compliance rates since March 2020 and is being closely monitored.” 


How ICO involvement affected forces 


The consensus from forces in our workshops was that resourcing was the principal threat to information request timeliness. 
This re-emphasised one of the main challenges that we highlighted in our timeliness report whereby, according to the NPCC, 
since 2010 there had been a real-term reduction in overall police budgets of 19% and a 19.1% decrease in FTE civilian staff. 


In our workshops, five forces told us that the ICO involvement made it easier to build a business case for more resource 
being made available for information governance. They said that the scrutiny “gave us some teeth”, and that it “got senior 
people interested, throwing money at the issue.” Others reported a cultural attitude change, that compliance in the areas of 
concern “was now less of an afterthought than it had been”. 
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This appears to be supported by the results of our survey of all police forces. We asked whether the ICO taking a specific 
interest in UK police force timeliness data had an impact on their performance. More than a third of forces told us that the 
ICO taking a specific interest had an impact on timeliness performance in their force. Two forces followed this up with 
specific comments about the ICO involvement being a positive force for making the case for more funding. 


It can, of course, be said that regulatory activity, or the threat of it, should not mark the threshold by which compliance with 
the law will be taken seriously. Nevertheless, many forces clearly reacted positively and decisively once they had entered the 
monitoring and engagement process. 


The overwhelming theme from our conversations with these forces was how the demand on information rights teams - 
through increased numbers and complexity of FOI, data protection and other requests - had overtaken resource. It meant 
that forces were left with difficult decisions to make about the level of long-term resource to place in this area of compliance. 


Relationship with ICO 


We asked forces for feedback about anything that the ICO could do better in the monitoring and engagement process. 


Forces said that the time to hear back from the ICO after they had self-referred their compliance concerns was too long. One 
force said that they were contacted by the ICO about a complaint about an FOI request which did not refer to, or appear to 
know, that the force was involved in the monitoring process. Another force suggested that the ICO sharing good practice 
from around the police sector would be helpful. 


Sharing good practice was also one of the suggestions in the feedback to our survey of all forces. 
Responses to the survey also covered issues such as: 


e the length of time taken to handle FOIA complaints; 
e clearer communication about when monitoring ends; 
e a better understanding of the police sector in ICO staff; and 


e requests to review our guidance on manifestly unfounded or excessive subject access requests. 
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We asked all police forces what initiatives, beyond those recommended in our November 2020 report, they had pursued to 
drive compliance. This is a list of some of the methods that one or more of the forces has used to improve timeliness. 


Practice in the field 


1. Training 


2. Internal processes 
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More than one force implemented FOIA and SAR training and guidance for all staff. 
This ensured that colleagues were aware of their force’s statutory responsibilities 
and of the risks in failing to achieve compliance. 


One force sought the support of external FOIA training, with a consultant taking a 
look at processes. 


Some forces described use of internal points of contact to locate requested 
information. One force created a network of superintendents to lead this task -they 
understood the importance of the statutory duty, and could quality check the 
internal consultation response. 

Other forces overhauled their request handling process. One found that a consistent 
reason for missing the statutory deadline was not in gathering information but 
through delays in the sign-off process. They agreed a new internal sign-off process 
to improve the number of responses that went out on time. 

One force gave specific deadlines to internal contacts for returning information and 
views on disclosure during the request handling process. 

Another organised weekly meetings of request handlers with a specific focus on 
timeliness. This helped to increase accountability and decision making. 
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3. Staffing and use of 
existing resources 


4. Procedural changes 


5. Proactive 
disclosure 
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More than one force referred to the problem of losing trained staff that had been 
temporarily seconded to address request backlogs or other peaks in demand. A 
solution raised by one force involved having the ability to recall previously trained 
staff from elsewhere in the force. 


More than one force agreed overtime for information governance staff to access 
during spikes in demand 


Several forces audited and then improved their standard templates. 


A number of forces improved their interaction with the individuals that had sent in 
overdue requests. This helped establish when information requested was no longer 
required. This was particularly helpful for the forces that dealt with a substantial 
number of FOI and EIR requests from journalists. 


One force reported coupling webforms to their casework management systems to 
receive requests more directly. 


An improved triage system was set up at several previously underperforming forces. 
It enabled them to easily identify quick wins and pass less complex requests to 
junior staff. This freed up capacity in the trained and vetted information governance 
staff. 


At one force, they abandoned self-allocation of requests in favour of staff being 
given requests to handle by a team leader, based on their relative experience, 
workload or subject expertise. 


Publication strategies across one force helped increase transparency and reduce the 
burden of recurring requests. 


Another force reported “rekindling” the desire to proactively publish information, 
with efforts now underway to disclose dashboards of information that are frequently 
requested. 
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Concluding remarks 


This follow-up report explored whether police forces took up the recommendations from our November 2020 timeliness 
report and whether they had positive results. 


We found a good take-up in forces where the recommended actions were not already part of their practice. The data shows 
an upturn in performance against our key metrics across the sector, with positive feedback from forces about our report. 


Our analysis showed the impact that a high-profile event can have across the whole police sector. The data shows that forces 
can handle their anticipated workloads, but may struggle in the face of unexpected, temporary spikes in demand. 


This follow-up also evaluated the effectiveness of our programme of monitoring and engagement. The data shows that the 
forces undergoing the monitoring made more significant improvements than other forces. We will use the results of this work 
and the feedback from the police about the process to inform further pieces of monitoring work. 


A combination of the data and the feedback from the police implies that the ability to achieve compliance remains strongly 
linked to resourcing and accountability. 


We therefore encourage forces to regularly review each of the recommendations made in our timeliness report. This will help 
to continue the recent progress made as a result of hard work from across the police sector. 


We will also continue to take a specific interest in performance in the police sector. The progress we have seen appears 
fragile, and vulnerable to change. Within the last two years we have issued practice recommendations to four police forces 
and previously issued two enforcement notices for SAR performance. We will therefore continue to receive the information 
request data from all police forces through the NPCC. We will engage with the NPCC, analyse the data and work with forces 
to address poor performance. 
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